The module was read-only for PKI configuration, which is why standing up an
environment meant raw REST rather than cmdlets. Adds 15: New-, Set-, and Remove-
for certificate authorities, policies, profiles, applications, and PKI
subscribers.
New-InfisicalCertificateAuthority -Type Intermediate returns an authority that
can actually issue. Infisical creates a subordinate with status
pending-certificate and never invokes generateIntermediateCaCertificate from the
create path, so the cmdlet performs the remaining sequence: read the certificate
signing request, sign it with -ParentCaId, import the signed certificate and
chain back.
Policy and profile bodies are deeply nested, so the constraint objects and
per-enrollment-type config blocks are taken as dictionaries rather than as
dozens of parameters, matching how -Subject and -Metadata already work. Two
conversion details matter and are now pinned by tests:
- PowerShell callers capitalise hashtable keys, and @{ Required = ... } was
reaching the API as "Required", which its schema does not recognise. The
constraint vocabulary is emitted lower-cased while every other key keeps its
camelCase, since those are API field names supplied verbatim and lowercasing
ttlDays or isCA would silently drop them.
- An empty collection is omitted rather than sent. "allowed": [] reads to
Infisical as "allow nothing", never what @{ Allowed = @() } was meant to
express, and an entry carrying only "type" is rejected outright.
-EnrollmentConfig routes to the block matching -EnrollmentType so EST, ACME, and
SCEP settings arrive through one parameter. -AutoRenew is sent only when bound,
because a switch is false when absent and sending it unconditionally would
disable renewal on an update that never mentioned it.
-ProjectId is optional on all 15 and resolves as it does elsewhere. Every one
supports -WhatIf; Remove- cmdlets default to high confirm impact.
Also fixes Update-Changelog, which inserted the version heading above the notes
so the section the release workflow extracts held only the build line while the
notes stayed under Unreleased - every release published an empty changelog.
Co-Authored-By: Claude Opus 5 <noreply@anthropic.com>
gsadmin
139d1f3a05